CVE-2026-19016 vulnerabilities

Vulnerabilities for packages: consul-fips...

GHSA-7QHJ-3FG3-MH5R vulnerabilities

Vulnerabilities for packages: consul-fips...

GHSA-JGRX-MGXX-JF9V vulnerabilities

Vulnerabilities for packages: arangodb...

VulnCheck KEV: CVE-2026-59309

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...

Security Updates for Azure CycleCloud < 8.9.1

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-57969 - An improper input...

PT-2026-72124

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.5 Description When using mbedTLS, remote authenticated users can be misidentified because the system ignores the configured X.509 username identity lookup field. X.509 is a standard for public key...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

Exim: Multiple Vulnerabilities

Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

Debian dla-4740 : libecpg-compat3 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4740 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4740-1 [email protected]...

Security update for himmelblau (important)

openSUSE security update: security update for himmelblau ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21573-1 Rating: important References: bsc1270946 bsc1270985 bsc1273910 bsc1273911 bsc1273912 Cross-References: CVE-2026-45784 CVSS scores:...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

GHSA-JHG2-MVFW-XFPC

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73661

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-72856

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

CVE-2026-73421

NextAuth.js vulnerability CVE-2026-73421 affects next-auth v5: when server configuration has an error (e.g., missing issuer/authorization, unset AUTH_SECRET), the auth() wrapper can return a truthy error object in middleware, Route Handlers, React Server Components, etc. As a result, existence-ba...